THIS NOTICE DESCRIBES HOW MEDICAL, BEHAVIORAL HEALTH, AND SUBSTANCE USE DISORDER INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
A copy of the HIPAA Privacy Rule can be reviewed at the U.S. Department of Health and Human Services website: https://www.hhs.gov/hipaa/for-professionals/privacy/index.html. This Notice also addresses the federal confidentiality protections for substance use disorder ("SUD") patient records found at 42 U.S.C. § 290dd-2 and 42 CFR Part 2 ("Part 2").
Effective Date: January 1, 2024
Reflections Lifestyle Center provides outpatient behavioral health services, including Intensive Outpatient Program (IOP) and Partial Hospitalization Program (PHP) levels of care, and may provide diagnosis, treatment, or referral for treatment of substance use disorders. Because of this, information about you may be protected by two overlapping federal laws: the HIPAA Privacy Rule, which protects "protected health information" ("PHI") generally, and 42 CFR Part 2, which provides additional, stricter protection for "Part 2 records" — records created by or on behalf of a Part 2 program that identify a patient as having a substance use disorder or receiving SUD diagnosis, treatment, or referral services. This single combined Notice is intended to satisfy both the HIPAA Notice of Privacy Practices requirement (45 CFR § 164.520) and the Part 2 patient notice requirement (42 CFR § 2.22).
We are required by law to:
We reserve the right to change this Notice and to make the revised Notice effective for information we already have about you. If we make a material change, a revised copy will be posted at our facility and made available upon request to our Privacy Officer. You will be asked to acknowledge receipt of this Notice in writing; even if you do not sign the acknowledgment, we will still provide treatment.
42 CFR Part 2 prohibits unauthorized disclosure of these records. A general authorization for release of medical or other information is NOT sufficient for this purpose. Federal rules permit certain limited uses and disclosures of SUD treatment information without your specific written consent, as described in this Notice, but in general we must have your consent in writing before we can share information that would identify you as a person who has sought or received SUD diagnosis or treatment. Any person or entity that receives Part 2 information from us is generally prohibited from re-disclosing it further without your consent, unless otherwise permitted by Part 2.
For general PHI that is not a Part 2 record, we may use and disclose information for treatment, payment, and health care operations without your separate authorization, as described below.
Treatment: We may use and disclose information to provide, coordinate, or manage your care, including consulting with other providers, coordinating referrals, and sharing relevant information with your primary care physician or another treating provider.
Payment: We may use and disclose information to bill and collect payment from you, your insurance plan, or another payer, including verifying coverage, submitting claims, and responding to payer requests necessary for payment activities.
Health Care Operations: We may use and disclose information for activities such as quality improvement, staff training, licensing/accreditation, and other administrative functions necessary to run our program.
Appointment Reminders and Related Communications: We may contact you about appointments, treatment alternatives, or program information that may be of interest to you.
Important — SUD / Part 2 records are treated differently: Under the 2024 Part 2 Final Rule, Reflections Lifestyle Center may ask you to sign a single, general written consent authorizing the use and disclosure of your Part 2 record for treatment, payment, and health care operations going forward. If you have signed that consent, we may use and disclose your Part 2 record for those purposes as described above, and other HIPAA covered entities or business associates who lawfully receive your Part 2 record under that consent may generally further use or disclose it in accordance with HIPAA. If you have not signed such a consent, or if you have given only a specific, limited consent, we may use or disclose your Part 2 record only to the extent you have authorized, or as otherwise permitted below without consent.
SUD Counseling Notes: If a clinician keeps separate personal notes analyzing the content of an SUD counseling session (similar to psychotherapy notes), those notes receive extra protection. We will not use or disclose SUD counseling notes, even for treatment, payment, or health care operations, without your specific separate written consent, except for the originating clinician's own use.
The following disclosures may be made without your written authorization. Where a disclosure involves a Part 2 record, it is only made without your consent to the extent specifically permitted under 42 CFR Part 2, which is narrower than HIPAA in several respects noted below.
Family, Friends, or Others Involved in Your Care (general PHI only): For PHI that is not a Part 2 record, we may share information relevant to a person's involvement in your care or payment for care if you do not object, or if we reasonably determine it is in your best interest when you are not present or able to object.
Family, Friends, or Others Involved in Your Care (Part 2 / SUD records): Part 2 does NOT permit us to rely on an "opportunity to object" standard for SUD treatment information. We will not disclose information identifying you as receiving SUD treatment to family members, friends, or others involved in your care without your written consent, except in a bona fide medical emergency, or as otherwise described in this section.
Required by Law: We may disclose information, including Part 2 records, to the extent a disclosure is required by federal, state, or local law and the disclosure is limited to what the law requires.
Public Health Activities: We may disclose general PHI to public health authorities for purposes such as preventing disease, reporting births/deaths, reporting suspected child abuse or neglect, or FDA-regulated product safety reporting. For Part 2 records, we may disclose de-identified information to public health authorities consistent with the HIPAA de-identification standard without your consent; identifiable Part 2 records otherwise generally require your consent or a qualifying exception.
Health Oversight Activities: We may disclose information to a health oversight agency for activities such as audits, licensure reviews, and investigations necessary for oversight of the health care system or compliance with applicable law. Audit or evaluation activities involving Part 2 records are limited to what Part 2 permits.
Abuse, Neglect, or Domestic Violence: We may disclose information to appropriate authorities if we reasonably believe you have been the victim of abuse, neglect, or domestic violence, consistent with applicable law.
Lawsuits, Administrative Proceedings, and Law Enforcement: General PHI may be disclosed in response to a court order, subpoena, or similar legal process under certain conditions. Part 2 records receive substantially greater protection in legal proceedings: except in narrow circumstances (such as a qualifying court order issued after notice and an opportunity to be heard, or specific statutory exceptions), we will not disclose information that would identify you as having a substance use disorder in response to a subpoena, warrant, or other legal process without a Part 2-compliant court order or your consent.
Crime on Our Premises or Against Program Personnel: Part 2 permits us to report a crime committed on our premises or against our personnel, or an immediate threat to health or safety, to law enforcement, including limited identifying information about the perpetrator.
Medical Emergencies: We may disclose information, including Part 2 records, to medical personnel to the extent necessary to meet a bona fide medical emergency.
Research, Audit, and Evaluation: We may use or disclose information for research, audit, or program evaluation activities that meet the specific requirements of HIPAA and, where applicable, Part 2's separate research and audit/evaluation provisions.
Qualified Service Organizations: We may share Part 2 records with a Qualified Service Organization that provides services to our program (for example, billing or lab services) under a written agreement that obligates the organization to protect the information consistent with Part 2.
To Avert a Serious Threat to Health or Safety: We may use and disclose information, including Part 2 records consistent with the medical emergency exception, when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is made to someone reasonably able to prevent or lessen the threat.
Specialized Government Functions: Under limited conditions, we may disclose general PHI for certain military, national security, protective service, or correctional purposes as permitted by HIPAA. Part 2 does not include a comparable broad exception, so Part 2 records are not disclosed for these purposes absent your consent or another specific Part 2 exception.
Secretary of HHS / OCR: We are required to disclose information to the Secretary of HHS or the Office for Civil Rights when needed to investigate or determine our compliance with HIPAA and Part 2.
Workers' Compensation: We may disclose general PHI as authorized by and to the extent necessary to comply with workers' compensation laws.
Any use or disclosure not described above — including, for Part 2 records, essentially all disclosures outside the specific exceptions listed — requires your written authorization or consent. The release of psychotherapy notes requires your written authorization. This includes most marketing communications and any sale of your information, which always require your authorization. You may revoke a written authorization or consent at any time, except to the extent we have already acted in reliance on it.
You have the following rights with respect to your information, which generally apply to both general PHI and Part 2 records:
If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR). Complaints alleging a Part 2 violation may be filed directly with OCR, and you may file concurrently with Reflections Lifestyle Center. We will not retaliate against you for filing a complaint.
You may contact our Privacy Officer at: Prime Wellness Center LLC d/b/a Reflections Lifestyle Center, Privacy Officer, 4901 Windhaven Pkwy, Suite 200, The Colony, TX 75056. Phone: 469-777-4688. Email: info@reflectionslifestyle.com.
